CVE-2026-117656 Details

A vulnerability in the Sign in with Apple strategy of Pow-Auth Assent, affecting versions 0.1.25 prior to 0.3.2, allows an unauthenticated remote attacker to impersonate another user. This is achieved by manipulating the 'user' parameter in the authorization callback, which is controlled by the client. The issue arises because Apple does not verify this data before it is sent to the callback endpoint. The vulnerability allows attackers to override verified identity claims, such as the user's subject and email, with their own values, potentially leading to unauthorized access or actions on behalf of the impersonated user.

Users can update to Assent version 0.3.2 or later, which addresses the vulnerability by defaulting to ignore the 'user' parameter. If the unverified name is needed, it can be enabled, but will only include the 'given_name' and 'family_name' fields, without the ability to override verified claims.